CVE-2021-32800

Katalog CVE

CVSS 8.1 · High EPSS 1,8%

Kerentanan Missing Authentication for Critical Function pada nextcloud server. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.

Rincian

Terbit di NVD

7 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/server/pull/28078 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785v advisory pihak ketiga
• https://hackerone.com/reports/1271052 permissions required · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-17 advisory pihak ketiga